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DISTRIBUTED PACKET CAPTURE AND AGGREGATION 

ABSTRACT 

A system is described for monitoring and testing enterprise networks that tend to have 
a number of geographically dispersed devices and interconnected sub-networks. The system 
includes a plurality of distributed agents to capture packets from a network. The system 
further includes an aggregation module coupled to the network to receive and aggregate the 
captured packets. During the aggregation process, the aggregation module identifies 
duplicate packets that were captured by different agents as an originating packet traverses the 
network. A display is coupled to the aggregation module, presents the non-duplicate network 
packets, giving a user a clear illustration of network activity. For the duplicate packets, the 
aggregation module presents a representative packet, such as the originating packet, that may 
be expanded by the user to view the details of the duplicate packets. 
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